I have such props.conf
[api]
TZ = Europe/Moscow
MAX_TIMESTAMP_LOOKAHEAD = 25
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
BREAK_ONLY_BEFORE_DATE = true
TIME_PREFIX = ^
MAX_EVENTS = 5000
CHARSET = AUTO
KV_MODE = none
NO_BINARY_CHECK = true
category = Application
description = CamelAPI
TRANSFORMS-result = result
And events like
2017-11-01 10:38:01,814 [20 ]
----------------------------
requestID=Server&1509521881805-1676215
messageID=MetroRequest@1509521881806-1029061
actor=Asop->
api=AsopApi
method=asop_wr_start
type=response
elapsed=0.009
cardUID=04666B4AC34C80
cardNumber=0014175389
trxID=171100000226854667
trxPCID=72000DBDCC267407DB021DA042E4B268
session=136597463
And splunk recognize milliseconds until I add in my props.conf
ADD_EXTRA_TIME_FIELDS = false
After this every events apperars with time with zero milliseconds
In Splunk Enterprise 7.0.0 through 7.2.x, the configuration ADD_EXTRA_TIME_FIELDS
also controls the extraction of sub-second timestamps in events. If you set ADD_EXTRA_TIME_FIELDS
to false, you prevent sub-second extractions and the creation of time_* fields. See: Enhanced strptime() support.
In Splunk Enterprise 7.3.0 and later, a third setting was created for the ADD_EXTRA_TIME_FIELDS
configuration that allows the extraction sub-second timestamps in events while blocking the creation of additional time_* fields. See: Timestamp extraction configuration in props.conf.
Tell it your specific time format and see if it straightens up.
TIME_FORMAT = %Y-%m-%d %H:%M:$S,%3Q
I added it, but it doesn't work
milliseconds still missing
[api]
TZ = Europe/Moscow
MAX_TIMESTAMP_LOOKAHEAD = 25
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
BREAK_ONLY_BEFORE_DATE = true
TIME_PREFIX = ^
MAX_EVENTS = 5000
CHARSET = AUTO
KV_MODE = none
NO_BINARY_CHECK = true
category = Application
description = CamelAPI
TRANSFORMS-result = result
ADD_EXTRA_TIME_FIELDS = false
TIME_FORMAT = %Y-%m-%d %H:%M:$S,%3Q